CVE-2026-102087
Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).
When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.
This issue affects: Junos OS:
- All versions before 23.2R2-S6;
- 23.4 versions before 23.4R2-S7;
- 24.2 versions before 24.2R2-S4;
- 24.4 versions before 24.4R2-S4;
- 25.2 versions before 25.2R1-S2, 25.2R2;
Junos OS Evolved:
- All versions before 23.2R2-S6-EVO;
- 23.4 versions before 23.4R2-S8.11-EVO;
- 24.2 versions before 24.2R2-S4-EVO;
- 24.4 versions before 24.4R2-S5-EVO;
- 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).
When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.
This issue affects: Junos OS:
- All versions before 23.2R2-S6;
- 23.4 versions before 23.4R2-S7;
- 24.2 versions before 24.2R2-S4;
- 24.4 versions before 24.4R2-S4;
- 25.2 versions before 25.2R1-S2, 25.2R2;
Junos OS Evolved:
- All versions before 23.2R2-S6-EVO;
- 23.4 versions before 23.4R2-S8.11-EVO;
- 24.2 versions before 24.2R2-S4-EVO;
- 24.4 versions before 24.4R2-S5-EVO;
- 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
- Record
CVE-2026-102087- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-184
- Updated
- 2026-11-02
EUVDEUVD-2026-101454
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).
When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.
This issue affects: Junos OS:
- All versions before 23.2R2-S6;
- 23.4 versions before 23.4R2-S7;
- 24.2 versions before 24.2R2-S4;
- 24.4 versions before 24.4R2-S4;
- 25.2 versions before 25.2R1-S2, 25.2R2;
Junos OS Evolved:
- All versions before 23.2R2-S6-EVO;
- 23.4 versions before 23.4R2-S8.11-EVO;
- 24.2 versions before 24.2R2-S4-EVO;
- 24.4 versions before 24.4R2-S5-EVO;
- 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
- Record
EUVD-2026-101454- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-457r-m358-cv7v
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of...
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).
When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.
This issue affects: Junos OS:
- All versions before 23.2R2-S6;
- 23.4 versions before 23.4R2-S7;
- 24.2 versions before 24.2R2-S4;
- 24.4 versions before 24.4R2-S4;
- 25.2 versions before 25.2R1-S2, 25.2R2;
Junos OS Evolved:
- All versions before 23.2R2-S6-EVO;
- 23.4 versions before 23.4R2-S8.11-EVO;
- 24.2 versions before 24.2R2-S4-EVO;
- 24.4 versions before 24.4R2-S5-EVO;
- 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
- Record
GHSA-457r-m358-cv7v- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-184
- Updated
- 2026-11-02
NVD
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).
When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.
This issue affects: Junos OS:
- All versions before 23.2R2-S6;
- 23.4 versions before 23.4R2-S7;
- 24.2 versions before 24.2R2-S4;
- 24.4 versions before 24.4R2-S4;
- 25.2 versions before 25.2R1-S2, 25.2R2;
Junos OS Evolved:
- All versions before 23.2R2-S6-EVO;
- 23.4 versions before 23.4R2-S8.11-EVO;
- 24.2 versions before 24.2R2-S4-EVO;
- 24.4 versions before 24.4R2-S5-EVO;
- 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
- Record
CVE-2026-102087- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-184
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-102087 is a high vulnerability (CVSS 7.1) in Juniper Networks Junos Os, published October 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. No source names a fixed version.